Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Include OAuth libs into images #29

Merged
merged 6 commits into from
Oct 29, 2024
Merged

Include OAuth libs into images #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
05ef275
Include OAuth libs into images
see-quick Oct 22, 2024
10a8297
remove un-necessary
see-quick Oct 22, 2024
cdfc50f
delete oauth libs
see-quick Oct 22, 2024
abe9066
remove also include
see-quick Oct 22, 2024
0ef9121
also update docker cmd
see-quick Oct 25, 2024
aced739
update also jackson libs for server-side
see-quick Oct 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,21 +7,22 @@ REGISTRY_ORGANIZATION ?= strimzi-test-container
IMAGE_TAG ?= main
DOCKER_VERSION_ARG ?= latest
ARCHS ?= amd64
DOCKER_CMD ?= docker

all: docker_prepare_base_images prepare docker_build docker_tag_push clean

docker_prepare_base_images:
./images/base/build_base_images.sh $(DOCKER_VERSION_ARG) $(PROJECT_NAME_BASE) "$(ARCHS)" $(DOCKERFILE_BASE_DIR)
./images/base/build_base_images.sh $(DOCKER_VERSION_ARG) $(PROJECT_NAME_BASE) "$(ARCHS)" $(DOCKERFILE_BASE_DIR) $(DOCKER_CMD)

docker_build:
./images/build_push_images.sh $(DOCKER_VERSION_ARG) $(PROJECT_NAME) $(DOCKERFILE_DIR) "$(ARCHS)"
./images/build_push_images.sh $(DOCKER_VERSION_ARG) $(PROJECT_NAME) $(DOCKERFILE_DIR) "$(ARCHS)" $(DOCKER_CMD)

docker_tag_push:
./images/tag_push_images.sh $(PROJECT_NAME) $(REGISTRY) $(REGISTRY_ORGANIZATION) $(QUAY_USER) $(QUAY_PASS) "$(ARCHS)"
./images/tag_push_images.sh $(PROJECT_NAME) $(REGISTRY) $(REGISTRY_ORGANIZATION) $(QUAY_USER) $(QUAY_PASS) "$(ARCHS)" $(DOCKER_CMD)

prepare: clean
./images/download_kafka.sh

clean:
rm -rf images/kafka_binaries
rm -rf images/kafka_tars
rm -rf images/kafka_binaries || true
rm -rf images/kafka_tars || true
8 changes: 8 additions & 0 deletions images/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,14 @@ ENV SCALA_VERSION=${SCALA_VERSION}

COPY ./kafka_binaries/kafka_${SCALA_VERSION}\-${KAFKA_VERSION} $KAFKA_HOME

# Copy OAuth libraries into $KAFKA_HOME/libs/ after copying Kafka binaries
RUN if [ -d "/opt/kafka/oauth-libs" ]; then \
echo "Including OAuth libraries in the derived image..."; \
cp -r /opt/kafka/oauth-libs/* $KAFKA_HOME/libs/; \
else \
echo "OAuth libraries not found in base image. Skipping OAuth libraries in the derived image."; \
fi

WORKDIR $KAFKA_HOME

USER 1001
32 changes: 29 additions & 3 deletions images/base/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,32 @@ FROM registry.access.redhat.com/ubi8/ubi-minimal:latest

USER root

RUN microdnf update \
&& microdnf --setopt=install_weak_deps=0 --setopt=tsflags=nodocs install java-17-openjdk-headless shadow-utils \
&& microdnf clean all
ARG OAUTH_LIB_VERSION=0.15.0
ARG NIMBUS_JOSE_JWT_VERSION=9.37.2
ARG JACKSON_ANNOTATION_VERSION=2.16.2
ARG JACKSON_DATABIND_VERSION=2.16.2
ARG JSON_PATH_VERSION=2.9.0

# Install Java and other necessary packages
RUN microdnf update -y && \
microdnf --setopt=install_weak_deps=0 --setopt=tsflags=nodocs install -y \
java-17-openjdk-headless shadow-utils wget && \
microdnf clean all

# Download OAuth libraries
RUN echo "Including OAuth libraries in the base image..." && \
mkdir -p /opt/kafka/oauth-libs && \
OAUTH_COMMON_URL="https://repo1.maven.org/maven2/io/strimzi/kafka-oauth-common/${OAUTH_LIB_VERSION}/kafka-oauth-common-${OAUTH_LIB_VERSION}.jar" && \
OAUTH_SERVER_URL="https://repo1.maven.org/maven2/io/strimzi/kafka-oauth-server/${OAUTH_LIB_VERSION}/kafka-oauth-server-${OAUTH_LIB_VERSION}.jar" && \
OAUTH_SERVER_PLAIN_URL="https://repo1.maven.org/maven2/io/strimzi/kafka-oauth-server-plain/${OAUTH_LIB_VERSION}/kafka-oauth-server-plain-${OAUTH_LIB_VERSION}.jar" && \
OAUTH_KEYCLOAK_AUTHORIZER_URL="https://repo1.maven.org/maven2/io/strimzi/kafka-oauth-keycloak-authorizer/${OAUTH_LIB_VERSION}/kafka-oauth-keycloak-authorizer-${OAUTH_LIB_VERSION}.jar" && \
OAUTH_CLIENT_URL="https://repo1.maven.org/maven2/io/strimzi/kafka-oauth-client/${OAUTH_LIB_VERSION}/kafka-oauth-client-${OAUTH_LIB_VERSION}.jar" && \
NIMBUS_JOSE_JWT_URL="https://repo1.maven.org/maven2/com/nimbusds/nimbus-jose-jwt/${NIMBUS_JOSE_JWT_VERSION}/nimbus-jose-jwt-${NIMBUS_JOSE_JWT_VERSION}.jar" && \
Comment on lines +20 to +25
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So if you wanna do it this way ... aren't you missing Jackson Databind and Json Path?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, I tried using OAuth in test containers, and it worked well without any issues. If those libs were needed, would I get an error?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe a question on @mstruk?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But I guess they might be needed only in some configs?

Copy link
Member Author

@see-quick see-quick Oct 27, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But I guess they might be needed only in some configs?

That's what I am thinking also 🤔 .

Copy link
Member Author

@see-quick see-quick Oct 28, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay using OAUTHBEARER method throws

Caused by: java.lang.ClassNotFoundException: com.fasterxml.jackson.annotation.JsonKey
	at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)
	at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:525)
	... 53 more

when using producer and consumer so I think those dependencies needed.

# Jackson Libraries
JACKSON_ANNOTATION_URL="https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-annotations/${JACKSON_ANNOTATION_VERSION}/jackson-annotations-${JACKSON_ANNOTATION_VERSION}.jar" && \
JACKSON_DATABIND_URL="https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-databind/${JACKSON_DATABIND_VERSION}/jackson-databind-${JACKSON_DATABIND_VERSION}.jar" && \
# Json Path Library
JSON_PATH_URL="https://repo1.maven.org/maven2/com/jayway/jsonpath/json-path/${JSON_PATH_VERSION}/json-path-${JSON_PATH_VERSION}.jar" && \
# Download all JARs
wget -P /opt/kafka/oauth-libs "$OAUTH_COMMON_URL" "$OAUTH_SERVER_URL" "$OAUTH_SERVER_PLAIN_URL" \
"$OAUTH_KEYCLOAK_AUTHORIZER_URL" "$OAUTH_CLIENT_URL" "$NIMBUS_JOSE_JWT_URL" "$JACKSON_ANNOTATION_URL" "$JACKSON_DATABIND_URL" "$JSON_PATH_URL"
17 changes: 11 additions & 6 deletions images/base/build_base_images.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,29 +7,34 @@ DOCKER_VERSION_ARG=$1
PROJECT_NAME_BASE=$2
ARCHITECTURES=$3
DOCKERFILE_BASE_DIR=$4
DOCKER_CMD=$5

CURRENT_TAG=${CURRENT_TAG:-"local"}
OAUTH_LIB_VERSION=${OAUTH_LIB_VERSION:-0.15.0}

####
# BUILD BASE IMAGES
####
for ARCH in $ARCHITECTURES
do
echo "[INFO] Building image with name: strimzi/$PROJECT_NAME_BASE:$CURRENT_TAG-$ARCH)."
docker build --platform linux/$ARCH --build-arg version=$DOCKER_VERSION_ARG -t strimzi/$PROJECT_NAME_BASE:$CURRENT_TAG-$ARCH $DOCKERFILE_BASE_DIR
echo "[INFO] Building classic image with name: strimzi/$PROJECT_NAME_BASE:$CURRENT_TAG-$ARCH)."
$DOCKER_CMD build --platform linux/$ARCH \
--build-arg version=$DOCKER_VERSION_ARG \
--build-arg OAUTH_LIB_VERSION=$OAUTH_LIB_VERSION \
-t strimzi/$PROJECT_NAME_BASE:$CURRENT_TAG-$ARCH $DOCKERFILE_BASE_DIR

# "refresh" Docker's awareness of the image
docker save strimzi/$PROJECT_NAME_BASE:$CURRENT_TAG-$ARCH -o strimzi_base_$ARCH.tar
docker load -i strimzi_base_$ARCH.tar
$DOCKER_CMD save strimzi/$PROJECT_NAME_BASE:$CURRENT_TAG-$ARCH -o strimzi_base_$ARCH.tar
$DOCKER_CMD load -i strimzi_base_$ARCH.tar
# tagging this image eliminate this error
# ```
# ERROR: failed to solve: strimzi/base:local: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
# ```
# May be more likely to recognize this new tag as a local entity without trying to fetch it from a remote repository.
# This specific tagging can help in resolving ambiguities that Docker might have had with the original image name and tag.
docker tag strimzi/$PROJECT_NAME_BASE:$CURRENT_TAG-$ARCH strimzi/$PROJECT_NAME_BASE:latest-$ARCH``
$DOCKER_CMD tag strimzi/$PROJECT_NAME_BASE:$CURRENT_TAG-$ARCH strimzi/$PROJECT_NAME_BASE:latest-$ARCH``
done

# PRINT ALL IMAGES
docker images
$DOCKER_CMD images

5 changes: 3 additions & 2 deletions images/build_push_images.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,10 @@ DOCKER_VERSION_ARG=$1
PROJECT_NAME=$2
DOCKERFILE_DIR=$3
ARCHITECTURES=$4
DOCKER_CMD=$5

# PRINT ALL IMAGES
docker images
$DOCKER_CMD images

#####
# FOR EACH KAFKA VERSION BUILD IMAGE WITH DIFFERENT TAG (i.e., 'strimzi-test-container/test-container:0.1.0-kafka-2.8.1)
Expand All @@ -37,7 +38,7 @@ do
for ARCH in $ARCHITECTURES
do
echo "[INFO] Building image with name: strimzi-test-container/$PROJECT_NAME:$CURRENT_TAG-$ARCH $KAFKA_VERSION with $SCALA_VERSION)."
docker build --platform linux/$ARCH --build-arg version=$DOCKER_VERSION_ARG --build-arg KAFKA_VERSION=$KAFKA_VERSION --build-arg SCALA_VERSION=$SCALA_VERSION --build-arg ARCH=$ARCH -t strimzi/$PROJECT_NAME:$CURRENT_TAG-$ARCH $DOCKERFILE_DIR
$DOCKER_CMD build --platform linux/$ARCH --build-arg version=$DOCKER_VERSION_ARG --build-arg KAFKA_VERSION=$KAFKA_VERSION --build-arg SCALA_VERSION=$SCALA_VERSION --build-arg ARCH=$ARCH -t strimzi/$PROJECT_NAME:$CURRENT_TAG-$ARCH $DOCKERFILE_DIR
done
done

Expand Down
15 changes: 8 additions & 7 deletions images/tag_push_images.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,12 +24,13 @@ REGISTRY_ORGANIZATION=$3
QUAY_USER=$4
QUAY_PASS=$5
ARCHITECTURES=$6
DOCKER_CMD=$7

# PRINT ALL IMAGES
docker images
$DOCKER_CMD images

echo "Login into registry..."
docker login -u $QUAY_USER -p $QUAY_PASS $REGISTRY
$DOCKER_CMD login -u $QUAY_USER -p $QUAY_PASS $REGISTRY

#####
# FOR EACH KAFKA VERSION TAG AND PUSH IMAGE
Expand All @@ -38,16 +39,16 @@ for KAFKA_VERSION in $KAFKA_VERSIONS
do
CURRENT_TAG="$PRODUCT_VERSION-kafka-$KAFKA_VERSION"
echo "[INFO] Delete the manifest to the registry, ignore the error if manifest doesn't exist"
docker manifest rm $REGISTRY/$REGISTRY_ORGANIZATION/$PROJECT_NAME:$CURRENT_TAG || true
$DOCKER_CMD manifest rm $REGISTRY/$REGISTRY_ORGANIZATION/$PROJECT_NAME:$CURRENT_TAG || true
for ARCH in $ARCHITECTURES
do
echo "[INFO] Tagging strimzi/$PROJECT_NAME:$CURRENT_TAG-$ARCH to $REGISTRY/$REGISTRY_ORGANIZATION/$PROJECT_NAME:$CURRENT_TAG-$ARCH ..."
docker tag strimzi/$PROJECT_NAME:$CURRENT_TAG-$ARCH $REGISTRY/$REGISTRY_ORGANIZATION/$PROJECT_NAME:$CURRENT_TAG-$ARCH
$DOCKER_CMD tag strimzi/$PROJECT_NAME:$CURRENT_TAG-$ARCH $REGISTRY/$REGISTRY_ORGANIZATION/$PROJECT_NAME:$CURRENT_TAG-$ARCH
echo "[INFO] Pushing image with name: $REGISTRY/$REGISTRY_ORGANIZATION/$PROJECT_NAME:$CURRENT_TAG-$ARCH ..."
docker push $REGISTRY/$REGISTRY_ORGANIZATION/$PROJECT_NAME:$CURRENT_TAG-$ARCH
$DOCKER_CMD push $REGISTRY/$REGISTRY_ORGANIZATION/$PROJECT_NAME:$CURRENT_TAG-$ARCH
echo "[INFO] Create / Amend the manifest"
docker manifest create $REGISTRY/$REGISTRY_ORGANIZATION/$PROJECT_NAME:$CURRENT_TAG --amend $REGISTRY/$REGISTRY_ORGANIZATION/$PROJECT_NAME:$CURRENT_TAG-$ARCH
$DOCKER_CMD manifest create $REGISTRY/$REGISTRY_ORGANIZATION/$PROJECT_NAME:$CURRENT_TAG --amend $REGISTRY/$REGISTRY_ORGANIZATION/$PROJECT_NAME:$CURRENT_TAG-$ARCH
done
echo "[INFO] Push the manifest to the registry"
docker manifest push $REGISTRY/$REGISTRY_ORGANIZATION/$PROJECT_NAME:$CURRENT_TAG
$DOCKER_CMD manifest push $REGISTRY/$REGISTRY_ORGANIZATION/$PROJECT_NAME:$CURRENT_TAG
done